Application No.: 10/658,777 



Docket No.: 020501.0802PTUS 



AMENDMENTS TO THE CLAIMS 

Kindly amend the claims as follows: 
1. - 14. (Canceled) 

15. (Currently Amended) A method comprising: 
receiving network data; and 

processing the network data at a decoder chain to create input data for applying at least 
multi-dimensional content profiling: 

preventing, through the network data, leaks of information by at least applying the multi- 
dimensional content profilin g; and 

wherein the multi -dimensional content profiling comprises: 

loading one or more profiles, wherein the one or mor e profiles each comprise an 

expected set of statistical characteristics of data: 
continuously receiving the input data from the decoder chain: 
determining a probabilistic measure of membership of the input data relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 

one or more profiles; and 
generating a reactive measure if the pro babilistic measure meets the threshold 
requirement . 

16. (Original) The method of claim 15, wherein the information includes a digital asset. 

17. (Original) The method of claim 15, wherein the mulu- dimensional content profiling 
takes into account the structure of the information. 

18. (Canceled) 

19. (Canceled) 
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20. (Currently Amended) A machine- readable medium having encoded information, 
which when read and executed by a machine causes a method comprising: 

receiving network data; and 

processing the network data at a decoder chain to create input data for applying at least 
multi- dimensional content profiling : 

preventing, through the network data, leaks of information by at least applying multi- 
dimensional content profilin g: and 

wherein the multi- dimensional content profiling comprises: 

loading one or more profiles, wherein the one or more profiles each comprise an 

expected set of statistical characteristics of data: 
continuously receiving the input data from the decoder chain; 
determining a probabilistic measure of membership of the input dat a relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 

one or more profiles; and 
generating a reactive measure if the probabilistic measure meets the threshold 
requirement . 

21. (Canceled) 

22. (Canceled) 

23. (Currently Amended) An apparatus comprising: 
a receiver to receive network data; and 

a processor, coupled to the receiver, to prevent, through the network data, leaks of 
information by at least applying multi-dimensional content profilin g, wherein the processor 




processes the network data at a decoder chain to create input data for applying at least the multi- 
dimensional content profiling; 

the multi-dimensional content profiling comprising: 




loading one or more profiles, wherein the one or more profiles each comprise an 

expected set of statistical characteristics of data: 
continuously receiving the input data from the decoder chain: 
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determining a probabilistic measure of membership of the input data relative to the 

one or more profiles; 
comparing the probabilistic measure with a threshold requirement for each of the 

one or more profiles; and 
generating a reactive measure if the probabilistic measure meets the threshold 

requirement. 

24. (New) The method of claim 15, wherein processing the network data at the decoder 
chain comprises extracting data by removing one or more layers of content encoding selected from 
the group consisting of common compression, aggregation, file formats, encoding schemas, and 
combinations thereof. 

25. (New) The method of claim 15, further comprising creating the profile by: 
loading positive training sets of documents; 

representing each document from the positive training sets of documents as a point in 
multi- dimensional space; 

separating the individual points in the multi- dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the positive training sets of documents; and 

converting the set of hyperplanes into the profile. 

26. (New) The method of claim 25, further comprising creating the profile by: 
loading negative training sets of documents; 

representing each document from the negative training sets of documents as a point in 
multi-dimensional space; 

separating the individual points in the multi- dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the negative training sets of documents; and 

converting the set of hyperplanes into the profile. 
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27. (New) The method of claim 15, wherein determining the probabilistic measure 
comprises updating one or more counters in a predetermined order, calculating values of output 
dimensions based on the one or more counters, and calculating an output score based on the output 
dimensions wherein the output score represents the probabilistic measure. 

28. (New) The method of claim 15, wherein the preventing operates in real-time. 

29. (New) The method of claim 15, further comprising terminating sessions with leaks 
of information before the network data is fully transferred. 

30. (New) The method of claim 15, further comprising preventing, through the network 
data, leaks of information by also applying keyword scanning. 

3 1. (New) The machine- readable medium of claim 20, wherein the profile is created by 
loading positive training sets of documents; 

representing each document from the positive training sets of documents as a point in 
multi-dimensional space; 

separating the individual points in the multi-dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the positive training sets of documents; and 

converting the set of hyperplanes into the profile. 

32. (New) The machine- readable medium of claim 3 1 , wherein the profile is created by 
loading negative training sets of documents; 

representing each document from the negative training sets of documents as a point in 
multi-dimensional space; 

separating the individual points in the multi- dimensional space with a set of hyperplanes 
wherein the set of hyperplanes effectively separate the multi-dimensional space into regions 
representing the negative training sets of documents; and 

converting the set of hyperplanes into the profile. 
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33. (New) The machine-readable medium of claim 20, further comprising receiving the 
network data at a decoder chain prior to implementing the multi-dimensional content profiling, 
wherein the decoder chain extracts data by removing one or more layers of content decoding 
selected from the group consisting of common compression, aggregation, file formats, encoding 
schemas, and combinations thereof. 

34. (New) The machine-readable medium of claim 20, wherein the multi-dimensional 
content profiling further comprises establishing a connection with an alert module prior to sending 
the reactive measure. 

35. (New) The machine- readable medium of claim 20, wherein the calculating the set of 
output dimensions comprises determining one or more values for each counter and combining the 
one or more values for each counter to create the set of output dimensions. 

36. (New) The apparatus of claim 23, wherein the calculating an output score is 
performed for each of the one or more profiles. 
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